17 ms·

Firefox exploit found in the wild

415 points by _jomo 11y ago

aembleton 11y ago
If at all possible it would be worth naming and shaming the advertising network that is allowing this exploit through. Why do advertising networks allow advertisers to exectue Javascript? What need is there for it? Every time one of these exploits that use advertising networks is found, it just increases the value of blockers such as uBlock. Whether you accept adverts or not, you shouldn't have to accept javascript being executed on your machine that isn't from the site you visited.
- jacquesm 11y ago
  The networks themselves rely almost exclusively on javascript nowadays so the websites have little choice, the ad networks then in turn pass some or all of this trust to whoever makes the creatives, which up until recently were quite frequently done in flash and are now sometimes in javascript. Personally I think all ads should be served up in a totally passive visual format (png, jpeg, gif) and have no other attributes than a non-javascript link target. That would take care of almost all drive-by injection. But adnetworks serve up what their customers want and their customers want interactive ads because the click-through rates are higher and because otherwise the competition would be doing it and they go out of business. Ad networks that do serve up javascript should at a minimum pull the script to their own server and audit the code of the script. Good luck with that though. Fortunately it's easy enough to install an ad blocker and get rid of that part of the problem entirely but it would be nice if users without an ad blocker wouldn't have to worry about this.
  - aembleton 11y ago
    I agree. It's actually the animation of the adverts that I find most distracting. Text, and/or a static image - not an animated gif would be fine. I would enable ad networks that could guarantee that is all they will serve up.
    - juliangregorian 11y ago
      The distraction is the point. It's no use enabling only the ads that you're easily capable of ignoring.
- _pmf_ 11y ago
  > Why do advertising networks allow advertisers to exectue Javascript? Because there is an empty place in their wallet that they require to be filled.
- phpmal 11y ago
  One of the goals of ad networks is to fill as much capacity as possible before relinquishing control to the website owner. The website owner then passes that unused capacity to a chain of competing networks. The last in the chain is usually a poor quality remnant network with junk ads. The way an ad network fills capacity is by allowing other ad networks to be their advertisers. Those ad networks buy the crappy traffic and fill it with junk ads. It's those crappy ads that look bad and may have scams attached to them - they get passed around so much that they can get lost in the system. That said, premium campaigns can also have bad ads. Like advertisers pretending to be premium clients but under the right conditions (like geolocation, date, time, viewing host) the ads will turn bad. It's a game of cat and mouse, and those ad networks are more geared for sales.
- chippy 11y ago
  According to user fukusa is was not an advertising network rather it looks like the site was compromised to run the script and it was disguised as an ad.
- gorhill 11y ago
  > naming and shaming the advertising network that is allowing this exploit through The person who found and reported the exploit said this particular exploit did not originate from an ad server[1]. Without disabling javascript, I have always argued that merely disabling 3rd-party iframe tags is a good first move[2]: significantly less breakage than disabling javascript, yet this will effectively step up security/privacy protection. In the current case, the person who found it confirmed that just blocking 3rd-party frame tags would have foiled the exploit.[3] [1] https://news.ycombinator.com/item?id=10021894 https://news.ycombinator.com/item?id=10021894 [2] https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-Benefits-of-blocking-3rd-party-iframe-tags https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-Be... [3] https://news.ycombinator.com/item?id=10022096 https://news.ycombinator.com/item?id=10022096
jacquesm 11y ago
I don't even want my browser to have a 'local file context', is there a way to switch such behavior off entirely until explicit permission is given? All these extra bells and whistles added to browsers to allow websites to pretend they're 'native apps' should require a very large switch to be thrown from 'safe' to 'unsafe' whenever an application requests such a thing. And what a pdf reader has to do with javascript is a mystery as well. Systems that are too complex are almost by definition insecure.
- Dosenpfand 11y ago
  > And what a pdf reader has to do with javascript is a mystery as well. The whole reader is written in Javascript: https://mozilla.github.io/pdf.js/ https://mozilla.github.io/pdf.js/
  - jacquesm 11y ago
    Oh great. What could possibly go wrong, give javascript access to local storage through some 'hard to trigger' gate. That's just asking for it. Hindsight and all that but still, this is not a good idea. A browser should not use it's own internal language sandboxed for the web to have access to the local system through some loophole. It's only a matter of time before such a loophole becomes an exploit. I wonder if javascript has access to devices such as cameras and microphones through similar loopholes. That would be a bit of a problem.
    - st0p 11y ago
      WebRTC ;) https://en.wikipedia.org/wiki/WebRTC https://en.wikipedia.org/wiki/WebRTC
    - k8tte 11y ago
      Uh, welcome to the web @ 2015
    - stingraycharles 11y ago
      You're getting old and grumpy, Jacques, before you know it you will start your sentences with "back in the day..." :) On a more serious note, I guess this is the toll we have to pay for innovation pushing. I can understand the reasoning behind writing everything in JS: it allows you to consolidate a lot of mechanisms in a single platform. Once you have that platform secure, any application you will write will (should?) be secure too. Too bad that theory and practice are usually not the same, in practice..
Silhouette 11y ago
Some more details would be helpful here. Specifically: 1. If PDF files aren't set to open using Firefox's built-in PDF viewer, was the relevant system still vulnerable? (That is, if under Options->Applications, PDFs were set to something other than "Preview in Firefox", would this attack still work?) 2. Which were the 8 popular FTP clients potentially affected? 3. Was this specific case all that could be done or was it an example of a wider class of potential exploits? (That is, can we actually trust any sensitive credentials in any applications on any system that has been running Firefox before today? And could we have disclosed other sensitive information that was held in well known local files?) I do deal with sensitive details, and have access to lots of external systems run by various clients. If there is a real danger here then I need to act. If there isn't, then I would prefer not to spend the next 1-2 days of my time updating everything that could have been silently compromised instead of doing revenue-generating work, and worse, contacting every client I work with to notify them that their security may have been compromised and it's my responsibility.
- jacquesm 11y ago
  I'm roughly in the same boat as you but what I don't get is if your work is that sensitive then why don't you run with at least ghostery, umatrix and adblock on your machine? The last thing I need is to have to contact a customer to tell them their data might have escaped my desktop computer because I took my browser to some unsafe site. Also: start your browser in a VM.
  - Silhouette 11y ago
    I do run with the browser locked up tight. It runs basically no plug-ins by default, and I have multiple privacy and blocker plug-ins active. I also have a complete log of every piece of software and update to it that has been manually/voluntarily installed in the entire lifetime of every affected system. What I don't know right now is whether any of that actually helps me in this case.
    - jacquesm 11y ago
      I really recommend you use a VM for browsing, or even a physically separate computer from the one that you keep your sensitive stuff on. It's a pain but it's a lot better than any of the alternative scenarios.
0xffffabcd 11y ago
Yet another reason to use uBlock and NoScript. previous discussion: https://news.ycombinator.com/item?id=10020361 https://news.ycombinator.com/item?id=10020361
drvortex 11y ago
Why is anyone still using this browser anyway? Firefox is the new IE6.
- smcl 11y ago
  "...the new IE" has been thrown about so much it is basically an empty statement I'm afraid https://www.google.com/webhp?q=%22chrome+is+the+new+IE%22 https://www.google.com/webhp?q=%22chrome+is+the+new+IE%22 https://www.google.com/webhp?q=%22firefox+is+the+new+IE%22 https://www.google.com/webhp?q=%22firefox+is+the+new+IE%22 https://www.google.com/webhp?q=%22safari+is+the+new+IE%22 https://www.google.com/webhp?q=%22safari+is+the+new+IE%22
  - drvortex 11y ago
    If you had taken a moment to actually scan those search results, you would have realized that "Chrome is the new IE" is typically a reference to its ubiquity. Safari and Firefox is typically called the new IE because they are lagging behind the times. Which is why I said "IE6" in my original comment. The later versions of IE were very decent. They certainly didn't seem like the frozen accident of history - an issue Firefox continues to grapple with.
    - nnethercote 11y ago
      > Safari and Firefox is typically called the new IE because they are lagging behind the times. That's a reasonable criticism of Safari, which is updated infrequently and is lagging on all sorts of web standards, but not for Firefox.
- jacquesm 11y ago
  Because it is the only browser that is not tied hand-and-foot to some major global commercial player, and because each and every browser ever launched had security issues. Even lynx is not immune: http://www.cvedetails.com/vulnerability-list/vendor_id-5836/product_id-9869/Lynx-Lynx.html http://www.cvedetails.com/vulnerability-list/vendor_id-5836/...
mike-cardwell 11y ago
I'll just chuck this old blog post of mine out there: https://grepular.com/Protecting_a_Laptop_from_Simple_and_Sophisticated_Attacks https://grepular.com/Protecting_a_Laptop_from_Simple_and_Sop... Specifically, the "Securing the Web browser" section. [edit] Also worth mentioning is the stuff about smartcards on that blog post. You can steal my ~/.ssh/ and my ~/.gnupg/, but because I'm using a smartcard, it wont do you any good.
- jacquesm 11y ago
  Good stuff, suggest you add an entry about running the browser inside a VM of its own.
- reirob 11y ago
  Thanks for posting! I bookmarked the page and will use it when setting up my next laptop.
- pmoriarty 11y ago
  That's a great post. Very thorough. However, a couple of observations concerning some security issues you might not be aware of: First, X itself is very insecure, so by allowing your web browser to share the same X server as the rest of your apps, you are making the rest of your apps more vulnerable. Second, the so-called "Trusted" Platform Module you're using for extra entropy may itself not be very trustable, despite the name. So you may want to rethink that. Finally, according to the vendor of the GPG smartcard you're using, "the software on this card is not available as free software due to NDAs required for certain parts." That there are NDAs on parts of the card or the software (it's not clear which) makes the card suspect, and I don't see where I can get the source of the code (free or not) that's running on the card. An ideal smart card would, like gpg itself, have completely open and transparent hardware and software. I'm not sure if any of those kinds of cards exist, however. That said, I'm sure all the security measures you're taking in sum make you far better off than the typical computer user, but there's room for improvement.
  - mike-cardwell 11y ago
    Re X being insecure. Yep. People have brought this up in the comments of the blog post. It doesn't reduce security by shifting it to a different user, and no, it's not as good as running under a VM. However it does give it some extra protection. For example it would have protected your main users ~/.ssh/ and ~/.gnupg/ directories etc that this latest pdf.js vulnerability could have exposed. Re the TPM, even in the worse case scenario where the TPM is totally evil, it can't reduce the randomness on my system. It will either keep it the same or improve it. At least on Linux, where it is just one extra source of entropy on top of the other existing ones. Re the smart card, that may be the case, but it's probably the safest one out there, recommended and pushed by the guy who wrote GnuPG. It's worth noting that the blog post is 4 years old now.
Nanzikambe 11y ago
The lack of additional detail in this very sparse announcement really compromises users' ability to damage control effectively. Would like to know if an installation is vulnerable if: 1) If Applications, PDF is set to "Always ask" 2) Ublock and/or privoxy are used 3) Javascript is disabled 4) pdfjs.previousHandler.alwaysAskBeforeHandling == false 5) pdfjs.disabled == true Also which advertising network and which Russian site would be helpful for blocklists.
- tombrossman 11y ago
  Agreed, I use an ad blocker and have Firefox's PDF viewer disabled and I have no clue if I'm still vulnerable. At a minimum, I'd like to know if disabling the viewer is enough to mitigate the risk, or if popular add-ons like Adblock Plus, NoScript, or Privacy Badger are enough.
- 616c 11y ago
  Totally agreed. I use a few of those, and I have exempted pdf.js in the past because I would rather use that then native PDF readers on my work laptop, since Adobe Reader/Acrobat is a wonderfully famous vector. Inquiring minds would like to know.
- fukusa 11y ago
  Hi, I reported this 0-day. It used a PDF.JS same origin policy violation to access local files. You should be safe because you have javascript disabled and pdfjs.disabled set to true. There's no way for the script to run. It was on a international news website operating from Russia. The exploit was not on an ad network. The exploit was simply injected on every news article page through an iframe. Therefore I assume the news site was compromised. It could have been deliberately injected by the website operators, but I highly doubt it. The exploit targeted developers or tech-savvy people. On Linux, it targeted the contents of the ~/.ssh directory and some other sensitive files. I should say that I am not a security expert and I came across this 0-day by accident.
  - Nanzikambe 11y ago
    My thanks for reporting it and this clarification
joosters 11y ago
Firefox's 'About' page seems to lack enough information here. My page just said 'Firefox 39 available' and 'restart to upgrade'. But the exploit page notes that you need version 39.0.3 in order to be protected. So it's unclear if the upgrade would fix things or not.
- tempestn 11y ago
  Once you've updated, the About Firefox modal will show you the exact version number you're on.
  - ptha 11y ago
    Exactly, I had "Firefox 39 available", once I'd updated and checked "About Firefox", it's version 39.0.3
jonaslejon 11y ago
Since the vulnerability is in pdf.js, is the Tor Browser Bundle vulnerable?
- asddubs 11y ago
  the latest versions come with noscript, so not unless you explicitly enable javascript on that site
  - sp332 11y ago
    NoScript is installed but disabled by default. https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEnabled https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEna...
johnnydoebk 11y ago
Well, sending some user files to Ukrainian server is a bug. But sending hashes of your downloads to Google [1][2] is a feature, right? 1. https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work https://support.mozilla.org/en-US/kb/how-does-phishing-and-m... 2. https://bugzilla.mozilla.org/show_bug.cgi?id=1138721 https://bugzilla.mozilla.org/show_bug.cgi?id=1138721
- kiproping 11y ago
  How can I disable this.
  - mdibaiee 11y ago
    https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work#w_how-do-i-use-the-phishing-and-malware-protection-features https://support.mozilla.org/en-US/kb/how-does-phishing-and-m...
- chippy 11y ago
  Is this the list? https://dxr.mozilla.org/mozilla-central/source/toolkit/components/downloads/ApplicationReputation.cpp#391 https://dxr.mozilla.org/mozilla-central/source/toolkit/compo... Just executables, identified by file extension and if you are on Windows, .zip files as well.
- sp332 11y ago
  The first page says: "There are two times when Firefox will communicate with Mozilla’s partners while using Phishing and Malware Protection. The first is during the regular updates to the lists of reporting phishing and malware sites. No information about you or the sites you visit is communicated during list updates. The second is in the event that you encounter a reported phishing or malware site. Before blocking the site, Firefox will request a double-check to ensure that the reported site has not been removed from the list since your last update." That seems pretty reasonable. But the second one looks like it checks every executable file you download. Why isn't that mentioned on the FAQ?
ffuseronlinux 11y ago
I believe using "about:config" and setting "pdfjs.disabled" to "true" will neutralize the vulnerability, at least from the description they gave of it, but confirmation from them to that effect would be appreciated, especially for users stuck on the current (or older) version, as the download page acknowledges some might be: Note: If you use your Linux distribution's packaged version of Firefox, you will need to wait for an updated package to be released to its package repository It would be particularly scandalous if they knew that disabling pdfjs would suffice yet refused to mention it because they couldn't bear to see their precious CPU/memory-hogging scribd knockoff no one asked for being disabled by their users, in effect putting their grandiose vision of the browser-as-OS ahead of their users' security.
cesarb 11y ago
How many PDF.js security vulnerabilities have been found so far? A quick Google search found only four: https://www.mozilla.org/en-US/security/advisories/mfsa2013-99/ https://www.mozilla.org/en-US/security/advisories/mfsa2013-9... (another local file disclosure) https://www.mozilla.org/en-US/security/advisories/mfsa2015-33/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-3... (needs to be "combined with a separate vulnerability" to be exploitable) https://www.mozilla.org/en-US/security/advisories/mfsa2015-69/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-6... (needs to be "combined with a separate vulnerability" to be exploitable) https://www.mozilla.org/en-US/security/advisories/mfsa2015-78/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-7... (this one) It still is looking better than the plugin it replaced.
- creshal 11y ago
  > It still is looking better than the plugin it replaced. Not for long if this keeps up…
  - _wmd 11y ago
    For comparison, NIST NVD lists 445 CVEs for Acrobat, or at least 17 per year since introduction. However CVEs haven't been maintained since the early 90s, so that number should be much higher. I think pdf.js does just fine.
    - mike_hearn 11y ago
      pdf.js does a lot less, of course. Really you should compare Firefox to Acrobat, as they are both rich media rendering apps with a lot of functionality.
      - deleted 11y ago
        [deleted]
      - wlesieutre 11y ago
        pdf.js does a lot less, just how I like it. I can view PDFs and not have a constant stream of critical vulnerabilities to worry about. Did you know Acrobat supports viewing 3D models in PDFs? Not even kidding[1]. It has an unnecessarily huge attack surface. I will never use that and I work in engineering at a factory. [1] For example, http://help.actify.com/download/attachments/6651965/SF_export_pdf_acrobat_reader.png?version=1&modificationDate=1340282613673&api=v2 http://help.actify.com/download/attachments/6651965/SF_expor...
lorenzhs 11y ago
Once again, this demonstrates that blocking advertisements is a really good idea from an InfoSec perspective. Ad blocking not only abates a nuisance, it's an important security measure. cf https://twitter.com/swiftonsecurity/status/628401554907725824 https://twitter.com/swiftonsecurity/status/62840155490772582...
- fukusa 11y ago
  In this case, it was disguised as an advertisement but it was not running on an advertisement server. My adblocker did not catch it. It was injected into the page as an iframe twice. Once disguised as an ad ([IP-address]/ad.php), another time with just the IP-address of the server. I guess it was included a second time in case and adblocker catched the first one. Because it doesn't make sense to include the same exploit twice, unless I am missing something?
  - hokkos 11y ago
    How did you detected it ?
    - fukusa 11y ago
      The script triggered a file dialog showing it was trying to access a local file. I opened the Developer Tools and saw all kinds of other files being accessed, including my private and public keys. I nearly got a heart attack. I quickly revoked all SSH keys and started monitoring the requests to narrow it down before I submitted the bug ticket with all the information I had, including the exploit script that was executed.
      - fukusa 11y ago
        Update: I played around with the exploit some more to find out what exactly triggered the file dialog. Turns out my OS (Ubuntu 15.04) actually saved me. When you try to open a file with Firefox it will first try to map the file to a mimetype using the ExternalHelperAppService (https://developer.mozilla.org/en-US/docs/How_Mozilla_determines_MIME_Types#ExternalHelperAppService https://developer.mozilla.org/en-US/docs/How_Mozilla_determi...). In case a mimetype is found, a file dialog is shown so you can open the file with the right application, in case it is not, the contents of the file will be displayed in the browser. In this case my OS provided the ExternalHelperAppService with a mimetype for one of my public keys with the .pub file extension: application/vnd.ms-publisher. Of course that's not the correct mimetype for the public key file, but that's basically what saved me by showing a file dialog because it found a mimetype. All other files had no file extension so no mimetype was found. I also discovered that my private keys were all encrypted with a passphrase so even though they have been compromised it was not as bad as I initially believed.
Rexxar 11y ago
Why the new version number is "39.0.3" ? Did I miss "39.0.1" and "39.0.2" ?
- Aissen 11y ago
  They probably has some small updates in preparation (probably still in QA) that had to be skipped. Too lazy to do a bugzilla/hg check though.
- dveditz_ 11y ago
  39.0.1 and 39.0.2 fixed serious regressions in Firefox for Android in some configurations. They weren't security fixes.
  - Rexxar 11y ago
    Thanks, I didn't know the version numbers where global for every platforms.
mrbig4545 11y ago
I guess now is a good time to change my ssh keys. joy even though I don't use pdf.js, have ublock and a strong key password, I'm not risking it. I have access to so many servers, I'd rather spend 30 mins changing keys than take the chance
digital-rubber 11y ago
I wonder if mozilla will write a new letter regarding windows 10; how nice they protect users from using a vulnerable firefox :)
hornbill 11y ago
Out of curiosity, how many users will be opening pdf using pdf.js? Is it widely used? I was never comfortable with pdf.js and changed the setting to use the default pdf viewer in all my machines.
- sanxiyn 11y ago
  I uninstalled PDF viewers and always use pdf.js to view PDFs these days.
  - hornbill 11y ago
    I guess pdf.js will be advantageous if you are using browser always. Most of the times, I have multiple pdf files open side by side. So I had a pdf viewer in the machine.
- anc84 11y ago
  > I (...) changed the setting You can rest assured that 99% of Firefox users won't do that.
- async5 11y ago
  For users that are opted in telemetry reporting, it can go up to 40M PDF views per browser version [1] [1] http://telemetry.mozilla.org/dist.html#!cumulative=0&end_date=2015-06-05&max_channel_version=beta%252F38&measure=PDF_VIEWER_USED&min_channel_version=nightly%252F38&product=Firefox&sanitize=1&start_date=2015-03-04&trim=1&use_submission_date=0
currysausage 11y ago
Semi off-topic: What does the security track record of Chrome's integrated PDF viewer (PDFium) look like? Should I make it Click-to-play or is it about as secure as any other part of the browser? Edit: NVD does list a bunch of vulnerabilities with "PDFium" in them [1], and I guess there are a few more from when it wasn't called PDFium yet, but I'm curious as to how an expert would interpret these numbers. [1] https://web.nvd.nist.gov/view/vuln/search-results?query=pdfium&search_type=all&cves=on https://web.nvd.nist.gov/view/vuln/search-results?query=pdfi...
- async5 11y ago
  And even latest here http://googlechromereleases.blogspot.co.il/2015/07/stable-channel-update_21.html http://googlechromereleases.blogspot.co.il/2015/07/stable-ch... - 5 of them has pdfium
  - currysausage 11y ago
    Guess I will click-to-play PDFium, like all other plug-ins. Thanks!
    - async5 11y ago
      There is also https://chrome.google.com/webstore/detail/pdf-viewer/oemmndcbldboiebfnladdacbdfmadadm https://chrome.google.com/webstore/detail/pdf-viewer/oemmndc... :)
Grue3 11y ago
Another good idea is to never visit news sites based in Russia. Not only you won't get infected with random malware, you also won't have to read blatant propaganda that passes as "news" over here.
afeef 11y ago
Lol what ?
6d6b73 11y ago
That's what you get for making the web browser a platform to run applications.
51Cards 11y ago
I sit on the Firefox Beta channel; not seeing an update at the moment. Any word on the status of this?
- 51Cards 11y ago
  Update: Just received an update to the latest Beta of 40.0. Haven't found the change log but assuming this was the reason.
meapix 11y ago
For PDF, I never view pdf using browser, save it then open it using your pdf viewer.
mtgx 11y ago
Great, I applied the update, and now I got "Couldn't load the XPCOM", and I assume I have to reinstall Firefox.
callum85 11y ago
It's awesome that Mozilla detailed exactly what the exploit did, even which file paths it searched for.
- fukusa 11y ago
  The exploit basically uploaded the contents of a bunch of sensitive files to some server. Besides uploading the full list of files in the User directory (not the contents of the files) it uploaded the contents of the following files: Linux: /etc/passwd, /etc/hosts, /etc/hostname, /etc/issue, .bash_history, .mysql_history, .pgsql_history, .ssh/known_hosts, .ssh/authorized_keys, .ssh/id_sa, .remmina/.remmina, .remmina/.pref, .config/filezilla/.xml, .filezilla/.xml, pass.txt, access.txt, .sh, .config/psi+/profiles/default/accounts.xml Windows (in the User directories AppData/Roaming and Application Data): Subversion: config, servers, auth/svn.simple/* , auth/svn.simple/* .* SmartFTP: Client 2.0/Favorites/Quick Connect/* .xml Psi+: profiles/default/accounts.xml Notepad++: plugins/config/NppFTP/NppFTP.xml .purple: accounts.xml s3browser: * .xml, * .settings FileZilla: filezilla.xml, sitemanager.xml, recentservers.xml FTP Explorer: profiles.xml FTPRush: RushSite.xml FTPGetter: servers.xml FTP Now: sites.xml FTPInfo: ServerList.cfg, ServerList.xml GHISLER: wcx_ftp.ini Ipswitch: WS_FTP/Sites/ws_ftp.ini VanDyke: Config/Sessions/* .ini
  - cozzyd 11y ago
    Sounds like SELinux would have helped
  - andy112 11y ago
    Hi, I run the site https://scriptobservatory.org https://scriptobservatory.org, which scans the internet and keeps track of what JavaScript people are sent as they browse the internet. Could you drop me an email with a copy of the exploit script (OR a list of a few unique strings found in the exploit script)? With that, I can search the history of what we've been sent to get a list of all webpages that this exploit has been seen on. Email is scriptobservatory -at- gmail -dot- com or you can input it in the "Do you have a list of websites you want to be scanned regularly?" text box.
legulere 11y ago
And this is why we need working sandboxing on the desktop.
- timthelion 11y ago
  Have you seen subuser.org?
- rockdoe 11y ago
  If you enable e10s in Nightlies you will get sandboxing.
ommunist 11y ago
I am not security pro, but I wonder if server-side installations of PDF.js are exploitable? WordPress plugins using PDF.js, can these become a new vector to attack webservers? Case, site uses PDF.js plugin to render pDFs for users. Is it possible to access server filesystem through PDF.js?
- async5 11y ago
  There are not exploitable (at least not the same way). Firefox PDF viewer is a modification of PDF.js, so PDF.js code would run in the browser without a web server. The exploit might poke a hole in EMBED tag security of the web browser (and not in the PDF.js code itself). WP plugin shall be safe as any web application (unless it introduces similar security hole in its code, e.g. XSS).
lloydde 11y ago
I find the first sentence fascinating, "Yesterday morning, August 5, a Firefox user informed us...". I'd love to know more about this person and their skill set. How was the exploit detected and isolated? How did this issue get reported and resolved in s day? Assuming the Mozilla way, I wonder what the bugzilla report will read when it comes out of embargo.
- pfalke 11y ago
  It's HN user fukusa, who also comments in this thread
- fukusa 11y ago
  It's me. I discovered the exploit in the wild when I became a victim of it. Skill-set limited. I was able to identify it and understand what it basically does, but not much more.
  - zobzu 11y ago
    How long did it take between your discovery and mozilla fix?
    - fukusa 11y ago
      About 16 hours.
      - zobzu 11y ago
        Wow that's good. Thanks
  - lloydde 11y ago
    Modest too, "The script triggered a file dialog showing it was trying to access a local file. I opened the Developer Tools and saw all kinds of other files being accessed, including my private and public keys. I nearly got a heart attack. I quickly revoked all SSH keys and started monitoring the requests to narrow it down before I submitted the bug ticket with all the information I had, including the exploit script that was executed." Wow, lucky that it triggered a prompt. Thanks for the response!
bitmapbrother 11y ago
I wonder if Firefox is going to disable itself.
nandhp 11y ago
Could this exploit also be used to write to files? I have a feeling that it probably could, and that makes it even scarier.
jebblue 11y ago
Browsers are supposed to browse that's all. More and more stuff like this will come up with HTML5/JavaScript and people will begin to wonder why the world is jumping through all the JavaScript hoops to build a web app that is essentially a rich client app when they could use tools that are designed for that. Are they more or less secure, neither, once you can touch the user's filesystem the risk is the same which is why it still baffles me that developers actually want to code in JavaScript and dozens of one off libs when they could use first class tools which are far better designed. Browsers are supposed to browse, that is all they are supposed to do.
- thisjustinm 11y ago
  How do you define browse? To me browsing would include all the JS stuff we have now plus all kinds of things we haven't dreamed up yet. Call me old fashioned but I'm all for continuing to move the web forward. There will be vulnerabilities in native apps, there will be vulnerabilities in web apps or, put more simply, there will be vulnerabilities. Patch 'em up and charge ahead.
- syncsynchalt 11y ago
  The only viable rich client app frameworks I'm thinking of that are sandboxed are Flash, Java applets, and the OS X app store. The first two are at different stages of being universally disabled for security reasons, and the latter hasn't taken off and is not portable like the first two. Mobile is a different story of course, but also not portable. In short I'm not sure what you're suggesting.
- halosghost 11y ago
  Once upon a time, the Internet was supposed to just be a network of interconnected hypertext documents. But as soon as we decided that the Web should be a platform[1], and Netscape Navigator packaged JS, we started down a road where it's quite hard to return. I know it's an unpopular opinion, but I actually miss the days where webpages were static and did not need JS to load basic functionality. With the rise of the IoT, security is only going to be more and more difficult (e.g., all the automanufacturers' issues as of late); here's hoping we can figure out a way to make security mainstream… [1]: https://www.youtube.com/watch?v=r38al1w-h4k https://www.youtube.com/watch?v=r38al1w-h4k
raldu 11y ago
PDF.js reader can be disabled in Firefox by setting "pdfjs.disabled" value to true in "about:config".
riquito 11y ago
This exploit made me change my Ubuntu mirror because after hours the updated package wasn't yet in my configured mirror (but was available elsewhere). If you need it too, here's the list https://launchpad.net/ubuntu/+archivemirrors https://launchpad.net/ubuntu/+archivemirrors
mrob 11y ago
The article claims this exploit leaves no trace, but what about Linux atimes (assuming you don't have noatime set)? Eg. if you found multiple shell scripts with similar access times when you know you haven't worked on them at the same time. If this is a workable method of detection then it would be a good idea to avoid accessing any potentially affected files until you have recorded full access times.
ctb_mg 11y ago
These browser vulnerabilities have got me thinking that I should start browsing in a VM. Has anyone moved to this level of isolation? Steve Gibson on the last Security Now podcast said he's been experimenting with Sandboxie... Sandboxie looks like a paid closed source solution, I'm not sure they give me a compelling value proposition over something like a light linux distro under VirtualBox.
- Nexxxeh 11y ago
  I was for a while, using a W7 VM on VirtualBox. I hooked it up to the VPN interface so that if the VPN dropped, I wasn't leaking traffic and it couldn't access the local network or host machine without significant difficulty. It was initially for minimising the risk of false positives while testing remote access from the network I was on at the time. Probably not enough to be hacking NSA, but it quickly added layer of protection from leaking stuff.
ck2 11y ago
This is why I disable PDF viewing in any browser and have it send it to sumatraPDF instead
timthelion 11y ago
This is why everyone should consider running their web browser in a subuser: http://subuser.org http://subuser.org
segmondy 11y ago
time to start running everything in it's own container, i don't like the idea of docker for production, but i like the idea of docker for my desktop, i want to now run every single command in a container, i can run firefox in a linux container, eg. https://bbs.archlinux.org/viewtopic.php?id=196327 https://bbs.archlinux.org/viewtopic.php?id=196327
- timthelion 11y ago
  Have you seen subuser.org?
wnevets 11y ago
just more reasons to run ad blocking software
ergothus 11y ago
All the comments thus far have focused on the un/reasonableness of the vulnerability, plus some potshots at FF. I've not seen any discussion about how this exploit is targeting dev keys. I find that as a data point that we've turned the corner: The coder in this case decided to grab auth keys/passwords (with a presumably low rate of success). As logical as it may be (without RCE, not much more they could have done with a higher rate of success), I don't think it'd have been done ten years ago. Fascinating.
- fukusa 11y ago
  As far as I understand with this exploit it was only possible to read files, not write to them or compromise the targets in some other way. With that in mind, it makes sense to target keys. Because the keys are an indirect way to compromise new targets.
tacone 11y ago
> Yesterday morning, August 5, a Firefox user informed us that an advertisement on a news site in Russia was serving a Firefox exploit that searched for sensitive files and uploaded them to a server that appears to be in Ukraine. Which russian website, excuse me? Why not share the name?
deleted 11y ago
[deleted]
chilicuil 11y ago
Updating software shouldn't give a sense of security, instead use sandbox/cipher technologies more generalized, for firefox you could use firejail[0] or sandfox[1]. Or even more general approaches like subuser[2] or QubeOs[3]. Personally I use FF 28.x + Noscript + Adblock plus + Firejail 0.9.28-1 and I feel quite confident I won't get hacked by random attacks. [0] https://l3net.wordpress.com/2014/09/19/firejail-a-security-sandbox-for-mozilla-firefox/ https://l3net.wordpress.com/2014/09/19/firejail-a-security-s... [1] https://igurublog.wordpress.com/downloads/script-sandfox/ https://igurublog.wordpress.com/downloads/script-sandfox/ [2] http://subuser.org/ http://subuser.org/ [3] https://www.qubes-os.org/ https://www.qubes-os.org/

415 points by _jomo 11y ago

If at all possible it would be worth naming and shaming the advertising network that is allowing this exploit through. Why do advertising networks allow advertisers to exectue Javascript? What need is there for it? Every time one of these exploits that use advertising networks is found, it just increases the value of blockers such as uBlock. Whether you accept adverts or not, you shouldn't have to accept javascript being executed on your machine that isn't from the site you visited.

jacquesm 11y ago
The networks themselves rely almost exclusively on javascript nowadays so the websites have little choice, the ad networks then in turn pass some or all of this trust to whoever makes the creatives, which up until recently were quite frequently done in flash and are now sometimes in javascript. Personally I think all ads should be served up in a totally passive visual format (png, jpeg, gif) and have no other attributes than a non-javascript link target. That would take care of almost all drive-by injection. But adnetworks serve up what their customers want and their customers want interactive ads because the click-through rates are higher and because otherwise the competition would be doing it and they go out of business. Ad networks that do serve up javascript should at a minimum pull the script to their own server and audit the code of the script. Good luck with that though. Fortunately it's easy enough to install an ad blocker and get rid of that part of the problem entirely but it would be nice if users without an ad blocker wouldn't have to worry about this.
- aembleton 11y ago
  I agree. It's actually the animation of the adverts that I find most distracting. Text, and/or a static image - not an animated gif would be fine. I would enable ad networks that could guarantee that is all they will serve up.
  - juliangregorian 11y ago
    The distraction is the point. It's no use enabling only the ads that you're easily capable of ignoring.
_pmf_ 11y ago
> Why do advertising networks allow advertisers to exectue Javascript? Because there is an empty place in their wallet that they require to be filled.
phpmal 11y ago
One of the goals of ad networks is to fill as much capacity as possible before relinquishing control to the website owner. The website owner then passes that unused capacity to a chain of competing networks. The last in the chain is usually a poor quality remnant network with junk ads. The way an ad network fills capacity is by allowing other ad networks to be their advertisers. Those ad networks buy the crappy traffic and fill it with junk ads. It's those crappy ads that look bad and may have scams attached to them - they get passed around so much that they can get lost in the system. That said, premium campaigns can also have bad ads. Like advertisers pretending to be premium clients but under the right conditions (like geolocation, date, time, viewing host) the ads will turn bad. It's a game of cat and mouse, and those ad networks are more geared for sales.
chippy 11y ago
According to user fukusa is was not an advertising network rather it looks like the site was compromised to run the script and it was disguised as an ad.
gorhill 11y ago
> naming and shaming the advertising network that is allowing this exploit through The person who found and reported the exploit said this particular exploit did not originate from an ad server[1]. Without disabling javascript, I have always argued that merely disabling 3rd-party iframe tags is a good first move[2]: significantly less breakage than disabling javascript, yet this will effectively step up security/privacy protection. In the current case, the person who found it confirmed that just blocking 3rd-party frame tags would have foiled the exploit.[3] [1] https://news.ycombinator.com/item?id=10021894 https://news.ycombinator.com/item?id=10021894 [2] https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-Benefits-of-blocking-3rd-party-iframe-tags https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-Be... [3] https://news.ycombinator.com/item?id=10022096 https://news.ycombinator.com/item?id=10022096

jacquesm 11y ago

I don't even want my browser to have a 'local file context', is there a way to switch such behavior off entirely until explicit permission is given? All these extra bells and whistles added to browsers to allow websites to pretend they're 'native apps' should require a very large switch to be thrown from 'safe' to 'unsafe' whenever an application requests such a thing. And what a pdf reader has to do with javascript is a mystery as well. Systems that are too complex are almost by definition insecure.

Dosenpfand 11y ago
> And what a pdf reader has to do with javascript is a mystery as well. The whole reader is written in Javascript: https://mozilla.github.io/pdf.js/ https://mozilla.github.io/pdf.js/
- jacquesm 11y ago
  Oh great. What could possibly go wrong, give javascript access to local storage through some 'hard to trigger' gate. That's just asking for it. Hindsight and all that but still, this is not a good idea. A browser should not use it's own internal language sandboxed for the web to have access to the local system through some loophole. It's only a matter of time before such a loophole becomes an exploit. I wonder if javascript has access to devices such as cameras and microphones through similar loopholes. That would be a bit of a problem.
  - st0p 11y ago
    WebRTC ;) https://en.wikipedia.org/wiki/WebRTC https://en.wikipedia.org/wiki/WebRTC
  - k8tte 11y ago
    Uh, welcome to the web @ 2015
  - stingraycharles 11y ago
    You're getting old and grumpy, Jacques, before you know it you will start your sentences with "back in the day..." :) On a more serious note, I guess this is the toll we have to pay for innovation pushing. I can understand the reasoning behind writing everything in JS: it allows you to consolidate a lot of mechanisms in a single platform. Once you have that platform secure, any application you will write will (should?) be secure too. Too bad that theory and practice are usually not the same, in practice..

Silhouette 11y ago

Some more details would be helpful here. Specifically: 1. If PDF files aren't set to open using Firefox's built-in PDF viewer, was the relevant system still vulnerable? (That is, if under Options->Applications, PDFs were set to something other than "Preview in Firefox", would this attack still work?) 2. Which were the 8 popular FTP clients potentially affected? 3. Was this specific case all that could be done or was it an example of a wider class of potential exploits? (That is, can we actually trust any sensitive credentials in any applications on any system that has been running Firefox before today? And could we have disclosed other sensitive information that was held in well known local files?) I do deal with sensitive details, and have access to lots of external systems run by various clients. If there is a real danger here then I need to act. If there isn't, then I would prefer not to spend the next 1-2 days of my time updating everything that could have been silently compromised instead of doing revenue-generating work, and worse, contacting every client I work with to notify them that their security may have been compromised and it's my responsibility.

jacquesm 11y ago
I'm roughly in the same boat as you but what I don't get is if your work is that sensitive then why don't you run with at least ghostery, umatrix and adblock on your machine? The last thing I need is to have to contact a customer to tell them their data might have escaped my desktop computer because I took my browser to some unsafe site. Also: start your browser in a VM.
- Silhouette 11y ago
  I do run with the browser locked up tight. It runs basically no plug-ins by default, and I have multiple privacy and blocker plug-ins active. I also have a complete log of every piece of software and update to it that has been manually/voluntarily installed in the entire lifetime of every affected system. What I don't know right now is whether any of that actually helps me in this case.
  - jacquesm 11y ago
    I really recommend you use a VM for browsing, or even a physically separate computer from the one that you keep your sensitive stuff on. It's a pain but it's a lot better than any of the alternative scenarios.

0xffffabcd 11y ago

Yet another reason to use uBlock and NoScript. previous discussion: https://news.ycombinator.com/item?id=10020361 https://news.ycombinator.com/item?id=10020361

drvortex 11y ago

Why is anyone still using this browser anyway? Firefox is the new IE6.

smcl 11y ago
"...the new IE" has been thrown about so much it is basically an empty statement I'm afraid https://www.google.com/webhp?q=%22chrome+is+the+new+IE%22 https://www.google.com/webhp?q=%22chrome+is+the+new+IE%22 https://www.google.com/webhp?q=%22firefox+is+the+new+IE%22 https://www.google.com/webhp?q=%22firefox+is+the+new+IE%22 https://www.google.com/webhp?q=%22safari+is+the+new+IE%22 https://www.google.com/webhp?q=%22safari+is+the+new+IE%22
- drvortex 11y ago
  If you had taken a moment to actually scan those search results, you would have realized that "Chrome is the new IE" is typically a reference to its ubiquity. Safari and Firefox is typically called the new IE because they are lagging behind the times. Which is why I said "IE6" in my original comment. The later versions of IE were very decent. They certainly didn't seem like the frozen accident of history - an issue Firefox continues to grapple with.
  - nnethercote 11y ago
    > Safari and Firefox is typically called the new IE because they are lagging behind the times. That's a reasonable criticism of Safari, which is updated infrequently and is lagging on all sorts of web standards, but not for Firefox.
jacquesm 11y ago
Because it is the only browser that is not tied hand-and-foot to some major global commercial player, and because each and every browser ever launched had security issues. Even lynx is not immune: http://www.cvedetails.com/vulnerability-list/vendor_id-5836/product_id-9869/Lynx-Lynx.html http://www.cvedetails.com/vulnerability-list/vendor_id-5836/...

mike-cardwell 11y ago

I'll just chuck this old blog post of mine out there: https://grepular.com/Protecting_a_Laptop_from_Simple_and_Sophisticated_Attacks https://grepular.com/Protecting_a_Laptop_from_Simple_and_Sop... Specifically, the "Securing the Web browser" section. [edit] Also worth mentioning is the stuff about smartcards on that blog post. You can steal my ~/.ssh/ and my ~/.gnupg/, but because I'm using a smartcard, it wont do you any good.

jacquesm 11y ago
Good stuff, suggest you add an entry about running the browser inside a VM of its own.
reirob 11y ago
Thanks for posting! I bookmarked the page and will use it when setting up my next laptop.
pmoriarty 11y ago
That's a great post. Very thorough. However, a couple of observations concerning some security issues you might not be aware of: First, X itself is very insecure, so by allowing your web browser to share the same X server as the rest of your apps, you are making the rest of your apps more vulnerable. Second, the so-called "Trusted" Platform Module you're using for extra entropy may itself not be very trustable, despite the name. So you may want to rethink that. Finally, according to the vendor of the GPG smartcard you're using, "the software on this card is not available as free software due to NDAs required for certain parts." That there are NDAs on parts of the card or the software (it's not clear which) makes the card suspect, and I don't see where I can get the source of the code (free or not) that's running on the card. An ideal smart card would, like gpg itself, have completely open and transparent hardware and software. I'm not sure if any of those kinds of cards exist, however. That said, I'm sure all the security measures you're taking in sum make you far better off than the typical computer user, but there's room for improvement.
- mike-cardwell 11y ago
  Re X being insecure. Yep. People have brought this up in the comments of the blog post. It doesn't reduce security by shifting it to a different user, and no, it's not as good as running under a VM. However it does give it some extra protection. For example it would have protected your main users ~/.ssh/ and ~/.gnupg/ directories etc that this latest pdf.js vulnerability could have exposed. Re the TPM, even in the worse case scenario where the TPM is totally evil, it can't reduce the randomness on my system. It will either keep it the same or improve it. At least on Linux, where it is just one extra source of entropy on top of the other existing ones. Re the smart card, that may be the case, but it's probably the safest one out there, recommended and pushed by the guy who wrote GnuPG. It's worth noting that the blog post is 4 years old now.

Nanzikambe 11y ago

The lack of additional detail in this very sparse announcement really compromises users' ability to damage control effectively. Would like to know if an installation is vulnerable if: 1) If Applications, PDF is set to "Always ask" 2) Ublock and/or privoxy are used 3) Javascript is disabled 4) pdfjs.previousHandler.alwaysAskBeforeHandling == false 5) pdfjs.disabled == true Also which advertising network and which Russian site would be helpful for blocklists.

tombrossman 11y ago
Agreed, I use an ad blocker and have Firefox's PDF viewer disabled and I have no clue if I'm still vulnerable. At a minimum, I'd like to know if disabling the viewer is enough to mitigate the risk, or if popular add-ons like Adblock Plus, NoScript, or Privacy Badger are enough.
616c 11y ago
Totally agreed. I use a few of those, and I have exempted pdf.js in the past because I would rather use that then native PDF readers on my work laptop, since Adobe Reader/Acrobat is a wonderfully famous vector. Inquiring minds would like to know.
fukusa 11y ago
Hi, I reported this 0-day. It used a PDF.JS same origin policy violation to access local files. You should be safe because you have javascript disabled and pdfjs.disabled set to true. There's no way for the script to run. It was on a international news website operating from Russia. The exploit was not on an ad network. The exploit was simply injected on every news article page through an iframe. Therefore I assume the news site was compromised. It could have been deliberately injected by the website operators, but I highly doubt it. The exploit targeted developers or tech-savvy people. On Linux, it targeted the contents of the ~/.ssh directory and some other sensitive files. I should say that I am not a security expert and I came across this 0-day by accident.
- Nanzikambe 11y ago
  My thanks for reporting it and this clarification

joosters 11y ago

Firefox's 'About' page seems to lack enough information here. My page just said 'Firefox 39 available' and 'restart to upgrade'. But the exploit page notes that you need version 39.0.3 in order to be protected. So it's unclear if the upgrade would fix things or not.

tempestn 11y ago
Once you've updated, the About Firefox modal will show you the exact version number you're on.
- ptha 11y ago
  Exactly, I had "Firefox 39 available", once I'd updated and checked "About Firefox", it's version 39.0.3

jonaslejon 11y ago

Since the vulnerability is in pdf.js, is the Tor Browser Bundle vulnerable?

asddubs 11y ago
the latest versions come with noscript, so not unless you explicitly enable javascript on that site
- sp332 11y ago
  NoScript is installed but disabled by default. https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEnabled https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEna...

johnnydoebk 11y ago

Well, sending some user files to Ukrainian server is a bug. But sending hashes of your downloads to Google [1][2] is a feature, right? 1. https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work https://support.mozilla.org/en-US/kb/how-does-phishing-and-m... 2. https://bugzilla.mozilla.org/show_bug.cgi?id=1138721 https://bugzilla.mozilla.org/show_bug.cgi?id=1138721

kiproping 11y ago
How can I disable this.
- mdibaiee 11y ago
  https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work#w_how-do-i-use-the-phishing-and-malware-protection-features https://support.mozilla.org/en-US/kb/how-does-phishing-and-m...
chippy 11y ago
Is this the list? https://dxr.mozilla.org/mozilla-central/source/toolkit/components/downloads/ApplicationReputation.cpp#391 https://dxr.mozilla.org/mozilla-central/source/toolkit/compo... Just executables, identified by file extension and if you are on Windows, .zip files as well.
sp332 11y ago
The first page says: "There are two times when Firefox will communicate with Mozilla’s partners while using Phishing and Malware Protection. The first is during the regular updates to the lists of reporting phishing and malware sites. No information about you or the sites you visit is communicated during list updates. The second is in the event that you encounter a reported phishing or malware site. Before blocking the site, Firefox will request a double-check to ensure that the reported site has not been removed from the list since your last update." That seems pretty reasonable. But the second one looks like it checks every executable file you download. Why isn't that mentioned on the FAQ?

ffuseronlinux 11y ago

I believe using "about:config" and setting "pdfjs.disabled" to "true" will neutralize the vulnerability, at least from the description they gave of it, but confirmation from them to that effect would be appreciated, especially for users stuck on the current (or older) version, as the download page acknowledges some might be: Note: If you use your Linux distribution's packaged version of Firefox, you will need to wait for an updated package to be released to its package repository It would be particularly scandalous if they knew that disabling pdfjs would suffice yet refused to mention it because they couldn't bear to see their precious CPU/memory-hogging scribd knockoff no one asked for being disabled by their users, in effect putting their grandiose vision of the browser-as-OS ahead of their users' security.

cesarb 11y ago

How many PDF.js security vulnerabilities have been found so far? A quick Google search found only four: https://www.mozilla.org/en-US/security/advisories/mfsa2013-99/ https://www.mozilla.org/en-US/security/advisories/mfsa2013-9... (another local file disclosure) https://www.mozilla.org/en-US/security/advisories/mfsa2015-33/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-3... (needs to be "combined with a separate vulnerability" to be exploitable) https://www.mozilla.org/en-US/security/advisories/mfsa2015-69/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-6... (needs to be "combined with a separate vulnerability" to be exploitable) https://www.mozilla.org/en-US/security/advisories/mfsa2015-78/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-7... (this one) It still is looking better than the plugin it replaced.

creshal 11y ago
> It still is looking better than the plugin it replaced. Not for long if this keeps up…
- _wmd 11y ago
  For comparison, NIST NVD lists 445 CVEs for Acrobat, or at least 17 per year since introduction. However CVEs haven't been maintained since the early 90s, so that number should be much higher. I think pdf.js does just fine.
  - mike_hearn 11y ago
    pdf.js does a lot less, of course. Really you should compare Firefox to Acrobat, as they are both rich media rendering apps with a lot of functionality.
    - deleted 11y ago
      [deleted]
    - wlesieutre 11y ago
      pdf.js does a lot less, just how I like it. I can view PDFs and not have a constant stream of critical vulnerabilities to worry about. Did you know Acrobat supports viewing 3D models in PDFs? Not even kidding[1]. It has an unnecessarily huge attack surface. I will never use that and I work in engineering at a factory. [1] For example, http://help.actify.com/download/attachments/6651965/SF_export_pdf_acrobat_reader.png?version=1&modificationDate=1340282613673&api=v2 http://help.actify.com/download/attachments/6651965/SF_expor...

lorenzhs 11y ago

Once again, this demonstrates that blocking advertisements is a really good idea from an InfoSec perspective. Ad blocking not only abates a nuisance, it's an important security measure. cf https://twitter.com/swiftonsecurity/status/628401554907725824 https://twitter.com/swiftonsecurity/status/62840155490772582...

fukusa 11y ago
In this case, it was disguised as an advertisement but it was not running on an advertisement server. My adblocker did not catch it. It was injected into the page as an iframe twice. Once disguised as an ad ([IP-address]/ad.php), another time with just the IP-address of the server. I guess it was included a second time in case and adblocker catched the first one. Because it doesn't make sense to include the same exploit twice, unless I am missing something?
- hokkos 11y ago
  How did you detected it ?
  - fukusa 11y ago
    The script triggered a file dialog showing it was trying to access a local file. I opened the Developer Tools and saw all kinds of other files being accessed, including my private and public keys. I nearly got a heart attack. I quickly revoked all SSH keys and started monitoring the requests to narrow it down before I submitted the bug ticket with all the information I had, including the exploit script that was executed.
    - fukusa 11y ago
      Update: I played around with the exploit some more to find out what exactly triggered the file dialog. Turns out my OS (Ubuntu 15.04) actually saved me. When you try to open a file with Firefox it will first try to map the file to a mimetype using the ExternalHelperAppService (https://developer.mozilla.org/en-US/docs/How_Mozilla_determines_MIME_Types#ExternalHelperAppService https://developer.mozilla.org/en-US/docs/How_Mozilla_determi...). In case a mimetype is found, a file dialog is shown so you can open the file with the right application, in case it is not, the contents of the file will be displayed in the browser. In this case my OS provided the ExternalHelperAppService with a mimetype for one of my public keys with the .pub file extension: application/vnd.ms-publisher. Of course that's not the correct mimetype for the public key file, but that's basically what saved me by showing a file dialog because it found a mimetype. All other files had no file extension so no mimetype was found. I also discovered that my private keys were all encrypted with a passphrase so even though they have been compromised it was not as bad as I initially believed.

Rexxar 11y ago

Why the new version number is "39.0.3" ? Did I miss "39.0.1" and "39.0.2" ?

Aissen 11y ago
They probably has some small updates in preparation (probably still in QA) that had to be skipped. Too lazy to do a bugzilla/hg check though.
dveditz_ 11y ago
39.0.1 and 39.0.2 fixed serious regressions in Firefox for Android in some configurations. They weren't security fixes.
- Rexxar 11y ago
  Thanks, I didn't know the version numbers where global for every platforms.

mrbig4545 11y ago

I guess now is a good time to change my ssh keys. joy even though I don't use pdf.js, have ublock and a strong key password, I'm not risking it. I have access to so many servers, I'd rather spend 30 mins changing keys than take the chance

digital-rubber 11y ago

I wonder if mozilla will write a new letter regarding windows 10; how nice they protect users from using a vulnerable firefox :)

hornbill 11y ago

Out of curiosity, how many users will be opening pdf using pdf.js? Is it widely used? I was never comfortable with pdf.js and changed the setting to use the default pdf viewer in all my machines.

sanxiyn 11y ago
I uninstalled PDF viewers and always use pdf.js to view PDFs these days.
- hornbill 11y ago
  I guess pdf.js will be advantageous if you are using browser always. Most of the times, I have multiple pdf files open side by side. So I had a pdf viewer in the machine.
anc84 11y ago
> I (...) changed the setting You can rest assured that 99% of Firefox users won't do that.
async5 11y ago
For users that are opted in telemetry reporting, it can go up to 40M PDF views per browser version [1] [1] http://telemetry.mozilla.org/dist.html#!cumulative=0&end_date=2015-06-05&max_channel_version=beta%252F38&measure=PDF_VIEWER_USED&min_channel_version=nightly%252F38&product=Firefox&sanitize=1&start_date=2015-03-04&trim=1&use_submission_date=0

currysausage 11y ago

Semi off-topic: What does the security track record of Chrome's integrated PDF viewer (PDFium) look like? Should I make it Click-to-play or is it about as secure as any other part of the browser? Edit: NVD does list a bunch of vulnerabilities with "PDFium" in them [1], and I guess there are a few more from when it wasn't called PDFium yet, but I'm curious as to how an expert would interpret these numbers. [1] https://web.nvd.nist.gov/view/vuln/search-results?query=pdfium&search_type=all&cves=on https://web.nvd.nist.gov/view/vuln/search-results?query=pdfi...

async5 11y ago
And even latest here http://googlechromereleases.blogspot.co.il/2015/07/stable-channel-update_21.html http://googlechromereleases.blogspot.co.il/2015/07/stable-ch... - 5 of them has pdfium
- currysausage 11y ago
  Guess I will click-to-play PDFium, like all other plug-ins. Thanks!
  - async5 11y ago
    There is also https://chrome.google.com/webstore/detail/pdf-viewer/oemmndcbldboiebfnladdacbdfmadadm https://chrome.google.com/webstore/detail/pdf-viewer/oemmndc... :)

Grue3 11y ago

Another good idea is to never visit news sites based in Russia. Not only you won't get infected with random malware, you also won't have to read blatant propaganda that passes as "news" over here.

afeef 11y ago

Lol what ?

6d6b73 11y ago

That's what you get for making the web browser a platform to run applications.

51Cards 11y ago

I sit on the Firefox Beta channel; not seeing an update at the moment. Any word on the status of this?

51Cards 11y ago
Update: Just received an update to the latest Beta of 40.0. Haven't found the change log but assuming this was the reason.

meapix 11y ago

For PDF, I never view pdf using browser, save it then open it using your pdf viewer.

mtgx 11y ago

Great, I applied the update, and now I got "Couldn't load the XPCOM", and I assume I have to reinstall Firefox.

callum85 11y ago

It's awesome that Mozilla detailed exactly what the exploit did, even which file paths it searched for.

fukusa 11y ago
The exploit basically uploaded the contents of a bunch of sensitive files to some server. Besides uploading the full list of files in the User directory (not the contents of the files) it uploaded the contents of the following files: Linux: /etc/passwd, /etc/hosts, /etc/hostname, /etc/issue, .bash_history, .mysql_history, .pgsql_history, .ssh/known_hosts, .ssh/authorized_keys, .ssh/id_sa, .remmina/.remmina, .remmina/.pref, .config/filezilla/.xml, .filezilla/.xml, pass.txt, access.txt, .sh, .config/psi+/profiles/default/accounts.xml Windows (in the User directories AppData/Roaming and Application Data): Subversion: config, servers, auth/svn.simple/* , auth/svn.simple/* .* SmartFTP: Client 2.0/Favorites/Quick Connect/* .xml Psi+: profiles/default/accounts.xml Notepad++: plugins/config/NppFTP/NppFTP.xml .purple: accounts.xml s3browser: * .xml, * .settings FileZilla: filezilla.xml, sitemanager.xml, recentservers.xml FTP Explorer: profiles.xml FTPRush: RushSite.xml FTPGetter: servers.xml FTP Now: sites.xml FTPInfo: ServerList.cfg, ServerList.xml GHISLER: wcx_ftp.ini Ipswitch: WS_FTP/Sites/ws_ftp.ini VanDyke: Config/Sessions/* .ini
- cozzyd 11y ago
  Sounds like SELinux would have helped
- andy112 11y ago
  Hi, I run the site https://scriptobservatory.org https://scriptobservatory.org, which scans the internet and keeps track of what JavaScript people are sent as they browse the internet. Could you drop me an email with a copy of the exploit script (OR a list of a few unique strings found in the exploit script)? With that, I can search the history of what we've been sent to get a list of all webpages that this exploit has been seen on. Email is scriptobservatory -at- gmail -dot- com or you can input it in the "Do you have a list of websites you want to be scanned regularly?" text box.

legulere 11y ago

And this is why we need working sandboxing on the desktop.

timthelion 11y ago
Have you seen subuser.org?
rockdoe 11y ago
If you enable e10s in Nightlies you will get sandboxing.

ommunist 11y ago

I am not security pro, but I wonder if server-side installations of PDF.js are exploitable? WordPress plugins using PDF.js, can these become a new vector to attack webservers? Case, site uses PDF.js plugin to render pDFs for users. Is it possible to access server filesystem through PDF.js?

async5 11y ago
There are not exploitable (at least not the same way). Firefox PDF viewer is a modification of PDF.js, so PDF.js code would run in the browser without a web server. The exploit might poke a hole in EMBED tag security of the web browser (and not in the PDF.js code itself). WP plugin shall be safe as any web application (unless it introduces similar security hole in its code, e.g. XSS).

lloydde 11y ago

I find the first sentence fascinating, "Yesterday morning, August 5, a Firefox user informed us...". I'd love to know more about this person and their skill set. How was the exploit detected and isolated? How did this issue get reported and resolved in s day? Assuming the Mozilla way, I wonder what the bugzilla report will read when it comes out of embargo.

pfalke 11y ago
It's HN user fukusa, who also comments in this thread
fukusa 11y ago
It's me. I discovered the exploit in the wild when I became a victim of it. Skill-set limited. I was able to identify it and understand what it basically does, but not much more.
- zobzu 11y ago
  How long did it take between your discovery and mozilla fix?
  - fukusa 11y ago
    About 16 hours.
    - zobzu 11y ago
      Wow that's good. Thanks
- lloydde 11y ago
  Modest too, "The script triggered a file dialog showing it was trying to access a local file. I opened the Developer Tools and saw all kinds of other files being accessed, including my private and public keys. I nearly got a heart attack. I quickly revoked all SSH keys and started monitoring the requests to narrow it down before I submitted the bug ticket with all the information I had, including the exploit script that was executed." Wow, lucky that it triggered a prompt. Thanks for the response!

bitmapbrother 11y ago

I wonder if Firefox is going to disable itself.

nandhp 11y ago

Could this exploit also be used to write to files? I have a feeling that it probably could, and that makes it even scarier.

jebblue 11y ago

Browsers are supposed to browse that's all. More and more stuff like this will come up with HTML5/JavaScript and people will begin to wonder why the world is jumping through all the JavaScript hoops to build a web app that is essentially a rich client app when they could use tools that are designed for that. Are they more or less secure, neither, once you can touch the user's filesystem the risk is the same which is why it still baffles me that developers actually want to code in JavaScript and dozens of one off libs when they could use first class tools which are far better designed. Browsers are supposed to browse, that is all they are supposed to do.

thisjustinm 11y ago
How do you define browse? To me browsing would include all the JS stuff we have now plus all kinds of things we haven't dreamed up yet. Call me old fashioned but I'm all for continuing to move the web forward. There will be vulnerabilities in native apps, there will be vulnerabilities in web apps or, put more simply, there will be vulnerabilities. Patch 'em up and charge ahead.
syncsynchalt 11y ago
The only viable rich client app frameworks I'm thinking of that are sandboxed are Flash, Java applets, and the OS X app store. The first two are at different stages of being universally disabled for security reasons, and the latter hasn't taken off and is not portable like the first two. Mobile is a different story of course, but also not portable. In short I'm not sure what you're suggesting.
halosghost 11y ago
Once upon a time, the Internet was supposed to just be a network of interconnected hypertext documents. But as soon as we decided that the Web should be a platform[1], and Netscape Navigator packaged JS, we started down a road where it's quite hard to return. I know it's an unpopular opinion, but I actually miss the days where webpages were static and did not need JS to load basic functionality. With the rise of the IoT, security is only going to be more and more difficult (e.g., all the automanufacturers' issues as of late); here's hoping we can figure out a way to make security mainstream… [1]: https://www.youtube.com/watch?v=r38al1w-h4k https://www.youtube.com/watch?v=r38al1w-h4k

raldu 11y ago

PDF.js reader can be disabled in Firefox by setting "pdfjs.disabled" value to true in "about:config".

riquito 11y ago

This exploit made me change my Ubuntu mirror because after hours the updated package wasn't yet in my configured mirror (but was available elsewhere). If you need it too, here's the list https://launchpad.net/ubuntu/+archivemirrors https://launchpad.net/ubuntu/+archivemirrors

mrob 11y ago

The article claims this exploit leaves no trace, but what about Linux atimes (assuming you don't have noatime set)? Eg. if you found multiple shell scripts with similar access times when you know you haven't worked on them at the same time. If this is a workable method of detection then it would be a good idea to avoid accessing any potentially affected files until you have recorded full access times.

ctb_mg 11y ago

These browser vulnerabilities have got me thinking that I should start browsing in a VM. Has anyone moved to this level of isolation? Steve Gibson on the last Security Now podcast said he's been experimenting with Sandboxie... Sandboxie looks like a paid closed source solution, I'm not sure they give me a compelling value proposition over something like a light linux distro under VirtualBox.

Nexxxeh 11y ago
I was for a while, using a W7 VM on VirtualBox. I hooked it up to the VPN interface so that if the VPN dropped, I wasn't leaking traffic and it couldn't access the local network or host machine without significant difficulty. It was initially for minimising the risk of false positives while testing remote access from the network I was on at the time. Probably not enough to be hacking NSA, but it quickly added layer of protection from leaking stuff.

ck2 11y ago

This is why I disable PDF viewing in any browser and have it send it to sumatraPDF instead

timthelion 11y ago

This is why everyone should consider running their web browser in a subuser: http://subuser.org http://subuser.org

segmondy 11y ago

time to start running everything in it's own container, i don't like the idea of docker for production, but i like the idea of docker for my desktop, i want to now run every single command in a container, i can run firefox in a linux container, eg. https://bbs.archlinux.org/viewtopic.php?id=196327 https://bbs.archlinux.org/viewtopic.php?id=196327

timthelion 11y ago
Have you seen subuser.org?

wnevets 11y ago

just more reasons to run ad blocking software

ergothus 11y ago

All the comments thus far have focused on the un/reasonableness of the vulnerability, plus some potshots at FF. I've not seen any discussion about how this exploit is targeting dev keys. I find that as a data point that we've turned the corner: The coder in this case decided to grab auth keys/passwords (with a presumably low rate of success). As logical as it may be (without RCE, not much more they could have done with a higher rate of success), I don't think it'd have been done ten years ago. Fascinating.

fukusa 11y ago
As far as I understand with this exploit it was only possible to read files, not write to them or compromise the targets in some other way. With that in mind, it makes sense to target keys. Because the keys are an indirect way to compromise new targets.

tacone 11y ago

> Yesterday morning, August 5, a Firefox user informed us that an advertisement on a news site in Russia was serving a Firefox exploit that searched for sensitive files and uploaded them to a server that appears to be in Ukraine. Which russian website, excuse me? Why not share the name?

deleted 11y ago

[deleted]

chilicuil 11y ago

Updating software shouldn't give a sense of security, instead use sandbox/cipher technologies more generalized, for firefox you could use firejail[0] or sandfox[1]. Or even more general approaches like subuser[2] or QubeOs[3]. Personally I use FF 28.x + Noscript + Adblock plus + Firejail 0.9.28-1 and I feel quite confident I won't get hacked by random attacks. [0] https://l3net.wordpress.com/2014/09/19/firejail-a-security-sandbox-for-mozilla-firefox/ https://l3net.wordpress.com/2014/09/19/firejail-a-security-s... [1] https://igurublog.wordpress.com/downloads/script-sandfox/ https://igurublog.wordpress.com/downloads/script-sandfox/ [2] http://subuser.org/ http://subuser.org/ [3] https://www.qubes-os.org/ https://www.qubes-os.org/